16088 matches found
CVE-2023-0729
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajaxsavesortorder function. This makes it possible for unauthenticated attackers to invoke this function via...
CVE-2023-0717
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxdeletefolder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke th...
CVE-2023-0726
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajaxeditfolder function. This makes it possible for unauthenticated attackers to invoke this function via forg...
CVE-2023-0731
The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2023-0418
The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-26326
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used t...
CVE-2023-6987
The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2023-25962
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Biplob Adhikari Accordion – Multiple Accordion or FAQs Builder plugin = 2.3.0 versions...
CVE-2023-7071
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possib...
CVE-2023-34008
Unauth. Reflected Cross-Site Scripting XSS vulnerability in weDevs WP ERP plugin = 1.12.3 versions...
CVE-2023-30472
Unauth. Reflected Cross-Site Scripting XSS vulnerability in MyThemeShop URL Shortener by MyThemeShop plugin = 1.0.17 versions...
CVE-2023-30483
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kiboko Labs Watu Quiz plugin = 3.3.9.2 versions...
CVE-2023-47660
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Wham Product Visibility by Country for WooCommerce plugin = 1.4.9 versions...
CVE-2023-41672
Cross-Site Request Forgery CSRF vulnerability in Rémi Leclercq Hide admin notices – Admin Notification Center plugin = 2.3.2 versions...
CVE-2023-23793
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Eightweb Interactive Read More Without Refresh plugin = 3.1 versions...
CVE-2023-23731
Cross-Site Request Forgery CSRF vulnerability in HasTheme WishSuite plugin = 1.3.3 versions...
CVE-2023-23803
Cross-Site Request Forgery CSRF vulnerability in HasThemes JustTables plugin = 1.4.9 versions...
CVE-2023-23683
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ozan Canakli White Label Branding for Elementor Page Builder plugin = 1.0.2 versions...